PT-2026-108766

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/sched component where the tcf idr delete index function fails to properly validate lookup results. When tcf action delete drops a reference, an unlocked...

CentOS Linux 8.5 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc (CENTOS8.5:CLSA-2026:1791552137)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1791552137 advisory. - A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untruste...

Linux Distros Unpatched Vulnerability : CVE-2026-107888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs when a job marked job-held-on-create refers to a temporary printer that ha...

Linux Distros Unpatched Vulnerability : CVE-2026-107708

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's getpacprincwithrealm that returns success while leaving the client...

CentOS Linux 8.4 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc (CENTOS8.4:CLSA-2026:1791552138)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1791552138 advisory. - A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untruste...

PT-2026-108768

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bpf offload dev match function where it incorrectly falls back to comparing offdev pointers after an exact netdev mismatch. Because bound-only programs typically...

Linux Distros Unpatched Vulnerability : CVE-2026-107655

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an...

CVE-2026-107708

A flaw was found in krb5. This vulnerability allows a compromised or malicious cross-realm trusted Key Distribution Center KDC to cause a Denial of Service DoS. By sending an S4U2Proxy delegation request containing a malformed client name within a Privilege Attribute Certificate PAC, an attacker...

CVE-2026-107778

A flaw was found in krb5. An authenticated remote attacker can cause a Denial of Service DoS by sending specially crafted forwarded credentials containing mismatched credential entries. This improper handling triggers a null pointer dereference, causing the service to crash and become unavailable...

CVE-2026-107733 SumatraPDF: Null-pointer dereference in `CmdExec` when no document tab is open

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand handles CmdExec by passing a null current-tab pointer to RunWithExe, which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at an integrity level greater than or equal t...

CVE-2026-107733 SumatraPDF: Null-pointer dereference in `CmdExec` when no document tab is open

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand handles CmdExec by passing a null current-tab pointer to RunWithExe, which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at an integrity level greater than or equal t...

CVE-2026-107733

In SumatraPDF version 3.6.1 and earlier for Windows, a null-pointer dereference occurs within the FrameOnCommand() function when handling CmdExec while no document tab is open. The root cause is the passing of a null current-tab pointer to RunWithExe(), leading to the dereferencing of WindowTab::...

EUVD-2026-95344

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is fals...

AZL-106839 CVE-2026-107778 affecting package krb5 1.21.3-5

MIT Kerberos 5 krb5 through 1.22.2 contains a NULL pointer dereference in makecredlist in rdcred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticketinfo entries through...

DEBIAN-CVE-2026-107778

MIT Kerberos 5 krb5 through 1.22.2 contains a NULL pointer dereference in makecredlist in rdcred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticketinfo entries through...

CVE-2026-107708

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's getpacprincwithrealm that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a...

CVE-2026-107778

MIT Kerberos 5 krb5 through 1.22.2 contains a NULL pointer dereference in makecredlist in rdcred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticketinfo entries through...

AZL-106836 CVE-2026-107708 affecting package krb5 1.21.3-5

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's getpacprincwithrealm that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a...

DEBIAN-CVE-2026-107708

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's getpacprincwithrealm that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a...

EUVD-2026-95256

MIT Kerberos 5 krb5 through 1.22.2 contains a NULL pointer dereference in makecredlist in rdcred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticketinfo entries through...